Threats, breaches, and defenses — what you need to know.
A ransomware affiliate has begun weaponizing AI coding assistants like Claude Code to autonomously steal LDAP credentials and exfiltrate SQL databases, marking a significant escalation in automated attack capabilities. Simultaneously, CISA has issued an emergency three-day deadline for federal agencies to patch a critical Zimbra vulnerability (CVE-2026-73570) that is already being exploited in the wild.
China-nexus state actors have breached 361 organizations across 47 countries within five days of a VMware vCenter patch release, while CISA has imposed an unprecedented 3-day patch deadline for federal enterprise flaws. Simultaneously, the Rust ecosystem suffered a supply chain attack on August 20, where malicious versions of three widely used crates were published from a compromised maintainer account before being removed within hours.
CISA has added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, including a critical macOS authentication flaw rated CVSS 9.8. Separately, ransomware operators are reportedly impersonating recovery firms to pressure previous victims into paying additional extortion demands.
Critical infrastructure faces a coordinated cyberattack surge with water systems across multiple U.S. states targeted via internet-exposed programmable logic controllers (PLCs), while Cisco patches an actively exploited zero-day in its Secure Firewall Management Center affecting thousands of organizations. Ransomware crews continue aggressive campaigns, with a major Japanese holding company newly compromised by RansomHouse.
Minnesota water systems face coordinated cyberattack affecting 30+ facilities as of July 29; Cisco Secure Firewall Management Center exploited in active zero-day attacks; Microsoft's July 2026 Patch Tuesday sets record with 570+ vulnerabilities including three zero-days, while a critical remote code execution flaw in open-source Ruflo (CVE-2026-59726, CVSS 10.0) emerges unpatched.
Arista VeloCloud Orchestrator faces active zero-day exploitation with critical OS injection vulnerability; Microsoft's historic July patch addresses 622 CVEs including three zero-days; Japanese frozen-food supplier Nichirei hit by ransomware disrupting logistics operations.
Microsoft's July 2026 Patch Tuesday set a new record with 570 CVE fixes including three zero-days already exploited in the wild, while Alibaba's Fastjson vulnerability (CVE-2026-16723, CVSS 9.0) poses immediate risk to Spring Boot applications. Ransomware groups continue targeting critical infrastructure and supply chain assets with renewed intensity as threat actors exploit patching delays.
Microsoft's July 2026 Patch Tuesday set a record with 622 CVE fixes including three exploited zero-days, triggering emergency patching deadlines across federal agencies. Ransomware campaigns are accelerating with new threat groups emerging weekly, while critical infrastructure faces mounting attacks from state-backed actors blurring the line between nation-state operations and criminal activity.
Ransomware activity surged in the past week with fresh reports of supply chain targeting and AI-enhanced tactics, while Microsoft's record-breaking July Patch Tuesday addressed 622 vulnerabilities including three zero-days already under active exploitation. Critical infrastructure remains in the crosshairs as Iranian-affiliated threat actors maintain pressure on operational technology systems.
Qilin ransomware gang is actively exploiting a critical Palo Alto Networks GlobalProtect vulnerability (CVE-2026-0257) to breach enterprise networks, while Microsoft's record-breaking July 2026 Patch Tuesday addressed 622 vulnerabilities including three zero-days already under attack. Ransomware volumes hit unprecedented levels with 7,551 publicly disclosed victims in 2026 and a 443% surge in Qilin activity, signaling an escalating threat landscape requiring immediate patch deployment and network monitoring.
Microsoft's July 2026 Patch Tuesday set a historic record with 622 CVE fixes including three actively exploited zero-days in SharePoint and Active Directory, while EY, Abbott Laboratories, and other major organizations confirmed significant security breaches. The scale of vulnerabilities and simultaneous breaches signals an escalating threat landscape requiring immediate patching prioritization.
Microsoft's record-breaking July 2026 Patch Tuesday unleashed 622 security flaws—including two actively exploited zero-days in SharePoint Server and Active Directory Federation Services—demanding immediate federal action. Identity-based attacks have overtaken exploits as the leading cause of ransomware breaches, while phishing campaigns now drive half of all ransomware incidents. Zero-day vulnerabilities and AI governance gaps continue to define the threat landscape as organizations race to patch critical infrastructure.
Microsoft's July 2026 Patch Tuesday delivered a record-breaking 622 CVE fixes including three zero-day vulnerabilities under active attack, marking the largest security update in company history. The critical patches address SharePoint and Active Directory Federation Services flaws already exploited in the wild. Meanwhile, Firefox and Chrome released emergency patches for critical vulnerabilities with public exploit code circulating.
Microsoft rushed a patch for the RoguePlanet Defender zero-day (CVE-2026-50656) after 29 days of active exploitation, while a critical jscrambler npm package compromise exposed thousands of developers to infostealer malware. Multiple critical CMS vulnerabilities are under active exploitation globally, signaling a dangerous shift toward widespread automated attacks on web infrastructure.
Microsoft patches the RoguePlanet Windows Defender zero-day 29 days after public exploit code dropped, while CISA orders federal agencies to patch critical vulnerabilities in Adobe ColdFusion and Langflow AI framework by Friday. Meanwhile, Accenture confirmed a massive data breach with attackers claiming theft of source code and encryption keys, highlighting the continued pressure on enterprise security from both active exploits and supply chain threats.
North Korea launched the largest npm supply chain attack of 2026, poisoning 140+ Mastra AI packages in 19 minutes. Meanwhile, CISA added SharePoint Server RCE CVE-2026-45659 to its known exploited vulnerabilities list after active attacks, and device code phishing has surged 37x in detections. Critical infrastructure faces mounting pressure from AI-enhanced ransomware and nation-state proxies.
A critically exploited SharePoint RCE vulnerability (CVE-2026-45659) now requires immediate U.S. federal agency patching, while ransomware groups are weaponizing AI agents and Langflow exploits to automate intrusions. Researchers warn of "industrialized" ransomware attacks through gang collaboration, and a modular malware framework called Avalon is spreading via phishing chains.
Microsoft Defender zero-day CVE-2026-33825 exploited in active ransomware attacks, while critical Oracle E-Business Suite vulnerability (CVE-2026-46817) faces widespread exploitation. A new two-stage malware called RustDuck is rapidly evolving to hijack routers and IoT devices for DDoS botnets, signaling accelerating threats across both enterprise and consumer infrastructure.
Oracle E-Business Suite suffers active exploitation of critical RCE flaw; libssh2 zero-day enables pre-auth remote code execution; insurance giant Aflac confirms breach after subsidiary compromise. Meanwhile, The Gentlemen ransomware group was itself hacked after hitting 483 victims, and Polymarket suffered supply chain attack via third-party vendor breach.
CISA adds two vulnerabilities to active exploitation catalog, while Cisco SD-WAN zero-day CVE-2026-20245 and Lantronix EDS5000 flaw CVE-2025-67038 show signs of widespread attack. Ransomware continues to evolve with AI, marking 2026 as the "year of AI-powered attacks" for threat actors.
Create custom signals on any topic. AI curates and delivers 24/7.
Create SignalPowered by
